sigrank 0.17.2 → 0.17.3

package/README.md

@@ -147,7 +147,7 @@ smithery tool call sigrank rank_paste '{"text": "1000000 500000 50000 800000"}'
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.17.0
+⊙ SigRank CLI  v0.17.3
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board

package/keystore.mjs

@@ -19,11 +19,15 @@ import {
   existsSync,
   chmodSync,
   unlinkSync,
+  readdirSync,
+  copyFileSync,
 } from "node:fs";
 import { generateKeyPairSync, randomUUID } from "node:crypto";
 
 const DIR = join(homedir(), ".sigrank-mcp");
 const PATH = join(DIR, "identity.json");
+const BACKUP_PREFIX = "identity.json.bak-";
+const MAX_BACKUPS = 5;
 
 /** SPKI DER prefix length for an ed25519 public key (12 bytes before the raw 32). */
 const SPKI_PREFIX_LEN = 12;
@@ -54,7 +58,8 @@ export function loadIdentity() {
   }
 }
 
-/** Write the identity with strict perms (dir 0700, file 0600). */
+/** Write the identity with strict perms (dir 0700, file 0600). Backs up the existing
+ * file before overwriting so a corrupt write or accidental reset can be recovered. */
 export function persistIdentity(identity) {
   mkdirSync(DIR, { recursive: true });
   try {
@@ -62,6 +67,17 @@ export function persistIdentity(identity) {
   } catch {
     /* best-effort on platforms without chmod */
   }
+  // Back up the existing identity before overwriting (resilience: if the write
+  // fails or the file is later lost, the backup carries the binding + keys).
+  if (existsSync(PATH)) {
+    try {
+      const stamp = Date.now();
+      copyFileSync(PATH, join(DIR, `${BACKUP_PREFIX}${stamp}`));
+      pruneBackups();
+    } catch {
+      /* best-effort — don't block the write */
+    }
+  }
   writeFileSync(PATH, `${JSON.stringify(identity, null, 2)}\n`, {
     mode: 0o600,
   });
@@ -118,6 +134,9 @@ export function bindingForFreshIdentity(existing, fresh) {
 /**
  * Load the existing identity, or generate + persist a fresh one. Idempotent: a
  * complete existing identity is returned untouched (never rotates a live key).
+ * Self-healing: if the identity has keys + device_id but no codename (binding
+ * lost via partial write / version transition), scans backups for a matching
+ * device_id and restores the binding before returning.
  */
 export function ensureIdentity() {
   const existing = loadIdentity();
@@ -126,6 +145,16 @@ export function ensureIdentity() {
     existing?.public_key &&
     existing?.device_id
   ) {
+    // Self-healing: keys present but binding lost → try to restore from backups.
+    if (!existing.codename || !existing.operator_id) {
+      const restored = restoreBindingFromBackups(existing.device_id);
+      if (restored) {
+        existing.codename = restored.codename;
+        existing.operator_id = restored.operator_id;
+        existing.enrolled_at = restored.enrolled_at;
+        return persistIdentity(existing);
+      }
+    }
     return existing;
   }
   // Regeneration path: a partial/corrupt record. The binding is tied to device_id —
@@ -160,3 +189,54 @@ export function clearIdentity() {
     /* best-effort */
   }
 }
+
+/** Keep at most MAX_BACKUPS backup files (oldest deleted first). */
+function pruneBackups() {
+  try {
+    const files = readdirSync(DIR)
+      .filter((f) => f.startsWith(BACKUP_PREFIX))
+      .sort(); // timestamp-suffixed → lexicographic = chronological
+    while (files.length > MAX_BACKUPS) {
+      unlinkSync(join(DIR, files.shift()));
+    }
+  } catch {
+    /* best-effort */
+  }
+}
+
+/** Scan backup files for one with the same device_id that carries a codename +
+ * operator_id binding. Returns { codename, operator_id, enrolled_at } or null.
+ * Used by ensureIdentity() to self-heal when the live file lost its binding
+ * (e.g. a partial write or version transition that preserved keys but dropped
+ * the binding metadata). Only restores from a backup with the SAME device_id —
+ * never crosses device boundaries (Frankenstein-identity guard). */
+export function restoreBindingFromBackups(device_id) {
+  if (!device_id) return null;
+  try {
+    const files = readdirSync(DIR)
+      .filter((f) => f.startsWith(BACKUP_PREFIX))
+      .sort()
+      .reverse(); // newest first — prefer the most recent binding
+    for (const f of files) {
+      try {
+        const bak = JSON.parse(readFileSync(join(DIR, f), "utf-8"));
+        if (
+          bak.device_id === device_id &&
+          bak.codename &&
+          bak.operator_id
+        ) {
+          return {
+            codename: bak.codename,
+            operator_id: bak.operator_id,
+            enrolled_at: bak.enrolled_at ?? null,
+          };
+        }
+      } catch {
+        /* skip corrupt backups */
+      }
+    }
+  } catch {
+    /* best-effort */
+  }
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",

package/tools.mjs

@@ -1461,6 +1461,30 @@ export async function callTool(name, args, opts = {}) {
         trust_status: ack.trust_status ?? "trusted",
       };
     }
+    // Recovery: if the server says device_already_enrolled but includes the
+    // codename/operator_id, the device IS bound server-side — record it locally
+    // and return enrolled instead of erroring. This handles the case where the
+    // local binding was lost (partial write, version transition) but the device
+    // is still enrolled server-side.
+    if (
+      ack.reason === "device_already_enrolled" &&
+      ack.codename &&
+      ack.operator_id
+    ) {
+      if (!opts.identity)
+        recordEnrollment({
+          codename: ack.codename,
+          operator_id: ack.operator_id,
+        });
+      return {
+        status: "enrolled",
+        codename: ack.codename,
+        operator_id: ack.operator_id,
+        device_id: id.device_id,
+        trust_status: ack.trust_status ?? "trusted",
+        recovered: true,
+      };
+    }
     return {
       status: "error",
       httpStatus: res.status,

package/tui.mjs

@@ -2049,7 +2049,7 @@ export async function runTui({
       renderConnect(connectId, codeBuf, connectMsg);
       const signOutHint = isSignedIn(connectId)
         ? `   ${dim("[X]")} sign out`
-        : "";
+        : "   " + dim("[X]") + " reset device";
       setFooter([
         `  ${hr()}`,
         `  ${dim("[Enter]")} sign in   ${dim("[Esc]")} clear/back${signOutHint}   ${dim("← →")} tabs   ${dim("[Q]")} quit`,
@@ -2166,14 +2166,16 @@ export async function runTui({
           try {
             const out = await callTool("enroll", { code });
             if (out.status === "enrolled") {
-              connectMsg = `${green("✓")} signed in as ${cyan(out.codename || "(operator)")}`;
+              connectMsg = out.recovered
+                ? `${green("✓")} recovered account: ${cyan(out.codename || "(operator)")} ${dim("(device was already bound)")}`
+                : `${green("✓")} signed in as ${cyan(out.codename || "(operator)")}`;
               codeBuf = "";
             } else {
               const reasons = {
                 code_invalid:
                   "that code is invalid, expired, or already used — generate a fresh one.",
                 device_already_enrolled:
-                  'this device is already signed in. Need a new key? Click "New key" at signalaf.com → Settings, then paste it here.',
+                  'this device is already bound. Press [X] to reset the device, then paste a fresh code from signalaf.com → Settings → "New key".',
                 bad_request: "the code or device key was malformed.",
                 rate_limited:
                   "too many attempts — wait a few minutes and retry.",
@@ -2214,14 +2216,20 @@ export async function runTui({
           await redraw();
           return;
         } // backspace
-        // [X] sign out / reset — only when signed in AND the code field is empty (so an
-        // 'x' typed mid-code still feeds the buffer). Drops the stale local credential so
-        // a server-revoked device stops reading as "signed in" + the next enroll provisions
-        // a fresh device_id (escapes the Frankenstein-identity / 409-re-enroll deadlock).
-        if (k === "x" && !codeBuf && isSignedIn(loadIdentity())) {
+        // [X] sign out / reset — when the code field is empty (so an 'x' typed mid-code
+        // still feeds the buffer). Drops the local credential so a server-revoked OR
+        // server-enrolled-but-locally-unbound device stops holding a stale device_id,
+        // and the next enroll provisions a fresh device_id (escapes the Frankenstein-
+        // identity / 409-re-enroll deadlock). Works whether or not isSignedIn() —
+        // otherwise a device enrolled server-side but unbound locally is un-escapable
+        // (can't sign in: device_already_enrolled; can't sign out: X gated off).
+        if (k === "x" && !codeBuf) {
+          const wasSignedIn = isSignedIn(loadIdentity());
           clearIdentity();
           codeBuf = "";
-          connectMsg = `${green("✓")} signed out — paste a new code to sign in`;
+          connectMsg = wasSignedIn
+            ? `${green("✓")} signed out — paste a new code to sign in`
+            : `${green("✓")} device reset — paste a new code to sign in`;
           await redraw();
           return;
         }